Rename an owned machine's console label

Write the owner's own label for their machine, and nothing else.

Task 12 §"Renaming a node", work item D6. One column moves. The address — <slug>.<nodes_base_domain>, and the hosted host <app>--<slug> built from the same slug — is untouchable here and this route has no expression for touching it: the slug is identity rather than a name, guarded by the generator, by :func:~nerdit_cloud.nodes.hosted.assert_slug and by the slug_no_double_hyphen check constraint, and renaming it would invalidate live URLs, DNS records and the certificate they sit under. The console says so on the form, beside the unchanged hostname, because this is the point at which the label and the address part company permanently.

Standing-gated, not entitlement-gated (D-NC8). The refusal ladder stops at :func:assert_account_active: a Free account reaches the same machine's own dashboard and renames it there for nothing, so a console that charged for the label would be a harder gate than the thing it is a console for. There is no hosted_public_entitled read on this path, deliberately, and a test pins the absence.

No daemon call either, for the same reason there is no tunnel byte in the takedown switch: the label is cloud state. An offline machine renames exactly as well as a live one, which is what makes this the one thing a person can tidy up while the box is off (owner decision, 2026-08-29 — nerdit locally keeps calling the machine whatever the daemon calls it, and making the two agree would be a node-link/v1 write path and a fixture bump for a cosmetic field).

This does not violate D-NC10. That rule governs data from the node; a label the owner authored is the owner's own data about their node — the same category as the column that already exists.